IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  change password date

    Posted 05/20/20 09:18 AM
    Hi,

       New to the group and I have a question. I'm trying to change the lastpwd on all AA* ID's to todays date. Anyone know what the command for that would be? Thanks in advance for any help.

    ------------------------------
    dean nai
    ------------------------------


  • 2.  RE: change password date

    Posted 05/20/20 10:47 AM
    Edited by Jeroen Tiggelman 05/27/20 01:59 AM
    Hi Dean,

    Assuming that you are talking about a system protected by RACF and that you have zSecure Admin's CKGRACF component available, I believe the command to use for one user would be
    CKGRACF FIELD USER <userid> SET PASSDATE('20142F'x) REASON('<my reason>')
    where I will note that value is 'yydddF'x (so tomorrow it would be '20143F'X).

    (You can find the CKGRACF commands in Chapter 12 of the zSecure Admin and Audit for RACF User Reference Guide.)

    A CARLa to generate those commands from the UI would be:
    n nopage dd=ckrcmd
    s c=user s=base mask=AA*
    sortlist "CKGRACF FIELD USER" key(0) "SET PASSDATE('200520'x) REASON('<my reason>')"

    (FTR, I did not test this. )

    I hope this helps.

    Regards,

    --Jeroen

    Edit:     Corrected date format. Thanks, Rob!

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------



  • 3.  RE: change password date

    Posted 05/20/20 10:57 AM
    BTW, if you want to build some kind of production job out of this, you should probably make the SELECT statement more specific, so that users that do not have a password at all are excluded.

    You can look at the CARLa in SCKRCARL(CKGXRUS) [= RECREATE USER] for inspiration.
    (Do a FIND for PASSDATE.)

    has_password=yes - self-explanatory, I hope

    --JJW

    ------------------------------
    Jeroen Tiggelman
    Software Development and Level 3 Support Manager IBM Security zSecure Suite
    IBM
    Delft
    ------------------------------

    Original Message


  • 4.  RE: change password date

    Posted 05/21/20 11:34 AM
    Edited by Rob van Hoboken 05/22/20 09:51 AM
    Passdate is stored as a julian date value, so that would be PASSDATE('20142F'x).
    But I wonder if it is a great idea to set the password change date.  This might allow users to keep using their ancient password for longer than the security policy allows.  If you believe users should never be reminded to change their password, you could change the PASSWORD INTERVAL for those users.

    ------------------------------
    Rob van Hoboken
    ------------------------------